CVE-2026-74872

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Severity: HIGH

Summary

The Whirlpool hash implementation in openssl_encrypt/modules/registry/hash_registry.py at lines 570-589 uses glob patterns to find .so modules in site-packages and loads the first match via importlib without verifying module integrity.

Affected Code

for site_pkg in site.getsitepackages():
    pattern = os.path.join(site_pkg, "whirlpool*py313*.so")
    py313_modules = glob.glob(pattern)
    if py313_modules:
        module_path = py313_modules[0]  # Takes first match
        loader = ExtensionFileLoader("whirlpool", module_path)
        spec = importlib.util.spec_from_file_location("whirlpool", module_path, loader=loader)
        whirlpool_module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(whirlpool_module)

Impact

The glob pattern "whirlpool*py313*.so" is broad and takes the first match without verifying:

• File hash/signature
• File ownership/permissions
• Whether it's a legitimate module

If an attacker can place a malicious .so file matching this pattern in any site-packages directory, it will be loaded and native code executed.

Recommended Fix

• Verify the module's integrity (hash or signature) before loading
• Use a specific filename rather than a glob pattern
• Check file permissions and ownership

Fix

Fixed in commit 963d0d1 on branch releases/1.4.x — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Severity: HIGH

Summary

The Whirlpool hash implementation in openssl_encrypt/modules/registry/hash_registry.py at lines 570-589 uses glob patterns to find .so modules in site-packages and loads the first match via importlib without verifying module integrity.

Affected Code

for site_pkg in site.getsitepackages():
    pattern = os.path.join(site_pkg, "whirlpool*py313*.so")
    py313_modules = glob.glob(pattern)
    if py313_modules:
        module_path = py313_modules[0]  # Takes first match
        loader = ExtensionFileLoader("whirlpool", module_path)
        spec = importlib.util.spec_from_file_location("whirlpool", module_path, loader=loader)
        whirlpool_module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(whirlpool_module)

Impact

The glob pattern "whirlpool*py313*.so" is broad and takes the first match without verifying:

• File hash/signature
• File ownership/permissions
• Whether it's a legitimate module

If an attacker can place a malicious .so file matching this pattern in any site-packages directory, it will be loaded and native code executed.

Recommended Fix

• Verify the module's integrity (hash or signature) before loading
• Use a specific filename rather than a glob pattern
• Check file permissions and ownership

Fix

Fixed in commit 963d0d1 on branch releases/1.4.x — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in site-packages directories to achieve native code execution when the module is loaded.